IN THE CLAIMS: 

1 . (Currently amended) A method in a data processing system for tracking 
relationships between programs and data, the method comprising: 

receiving a file access request from a program, wherein the file access request is 
for a file and is received at an operating system level and wherein the file is defined by a 
file name : 

id e ntifying creating an association between the file name and the program 
requesting the file access in response to receiving the file access request; and 

responsive to creating the association, storing the association between the file 
name and the program, wherein the association is used for subsequent accesses to the file 
such that a stored association is stored for each file name for which file access is 
requested by the program. 

2. (Original) The method of claim 1, wherein the association is stored as meta data. 

3. (Currently amended) The method of claim 1, wherein the association includes a 
fil e nam e for th e fil e and a program name for the program. 

4. (Original) The method of claim 3, wherein the association further includes at 
least one of a location of the file, a time of file access, a date of file access, an extension 
for the file, and an identification of a user of the program. 

5. (Original) The method of claim 4, wherein the location of the file is in a remote 
data processing system. 

6. (Original) The method of claim 1, wherein the file request is one of a request to 
open the file, close the file, copy the file, or delete the file. 
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7. (Original) The method of claim 1, wherein the program is a first program and 
wherein a request to open the file originates from the first program and a request to close 
the file originates from a second program. 

8. (Original) The method of claim 7, wherein the association includes the second 
program. 

9. (Previously presented) The method of claim 1, wherein the receiving step, the 
identifying step, and the storing step are performed within an operating system kernel. 

10. (Previously presented) The method of claim 1, wherein the receiving step, the 
identifying step, and the storing step are performed within a device driver. 

1 1 . (Original) The method of claim 10, wherein the drive driver intercepts calls 
directed to a mechanism used as a point of entry for the access. 

12. (Original) The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in a database. 

13. (Original) The method of claim 1, wherein associations are stored in a database 
and further comprising: 

receiving a request from a requestor to access the associations; 

querying the database for the associations; 

receiving a result from the database; and 

returning the result returned from the database to the requestor. 

14. (Original) The method of claim 13, wherein the associations are for a particular 
program. 

15. (Original) The method of claim 13, wherein the associations are for a particular 
file. 
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16. (Original) The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in at least one of a 

registry, file, and a file system. 

17. (Currently amended) A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instructions to receive a file access request from a program, wherein 
the file access request is for a file and is received at an operating system level and 
wherein the file is defined by a file name : id e ntifying create an association between the 
file name and the program requesting the file access in response to receiving the file 
access request; and responsive to creating the association, store the association between 
the file name and the program, wherein the association is used for subsequent accesses to 
the file such that a stored association is stored for each file name for which file access is 
requested by the program. 

18. (Original) The data processing system of claim 17, wherein the bus system is a 
single bus. 

19. (Original) The data processing system of claim 17, wherein the bus system 
includes a primary bus and a secondary bus. 

20. (Original) The data processing system of claim 17, wherein the processing unit 
includes a plurality of processors. 

21. (Original) The data processing system of claim 17, wherein the communications 
unit is one of a modem and Ethernet adapter. 
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22. (Currently amended) A data processing system for tracking relationships between 
programs and data, the data processing system comprising: 

receiving means for receiving a file access request fi:-om a program, wherein the 
file access request is for a file and is received at an operating system level and wherein 
the file is defined by a file name ; 

id e ntifying creating means for identifying creating an association between the file 
name and the program requesting the file access in response to receiving the file access 
request; and 

responsive to creating the association, storing means for storing the association 
between the file name and the program, wherein the association is used for subsequent 
accesses to the file such that a stored association is stored for each file name for which 
file access is requested by the program. 

23. (Original) The data processing system of claim 22, wherein the association is 
stored as meta data. 

24. (Currently amended) The data processing system of claim 22, wherein the 
association includes a fil e name for th e fil e and a program name for the program. 

25. (Original) The data processing system of claim 24, wherein the association 
further includes at least one of a location of the file, a time of file access, a date of file 
access, an extension for the file, and an identification of a user of the program. 

26. (Original) The data processing system of claim 25, wherein the location of the 
file is in a remote data processing system. 

27. (Original)The data processing system of claim 22, wherein the file request is one 
of a request to open the file, close the file, copy the file, or delete the file. 
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28. (Original) The data processing system of claim 22, wherein the program is a first 
program and wherein a request to open the file originates fi-om the first program and a 
request to close the file originates fi*om a second program. 

29. (Original) The data processing system of claim 22, wherein the association 
includes the second program. 

30. (Previously presented) The data processing system of claim 22, wherein the 
receiving means, the identifying means, and the storing means are located within an 
operating system kernel. 

31. (Previously presented) The data processing system of claim 22, wherein the 
receiving means, the identifying means, and the storing means are located within a device 
driver. 

32. (Original) The data processing system of claim 31, wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

33. (Original) The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in a database. 

34. (Original) The data processing system of claim 22, wherein associations are 
stored in a database, wherein the receiving means is a first receiving means, and further 
comprising: 

second receiving means for receiving a request from a requestor to access the 
associations; 

querying means for querying the database for the associations; 
third receiving means for receiving a result from the database; and 
returning means for retuming the result returned from the database to the 
requestor. 
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35. (Original) The data processing system of claim 34, wherein the associations are 
for a particular program. 

36. (Original) The data processing system of claim 34, wherein the associations are 
for a particular file. 

37. (Original) The data processing system of claim 22, wherein the storing means 
comprises: 

means for storing the association between the file and the program in at least one 
of a registry, file, and a file system. 

38. (Currently amended) A computer program product in a computer readable 
medium for tracking relationships between programs and data, the computer program 
product comprising: 

first instructions for receiving a file access request from a program, wherein the 
file access request is for a file and is received at an operating system level and wherein 
the file is defined by a file name ; 

second instructions for id e ntifying creating an association between the file name 
and the program requesting the file access in response to receiving the file access request; 
and 

third instructions fo r, responsive to creating the association, storing the 
association between the file name and the program, wherein the association is used for 
subsequent accesses to the file such that a stored association is stored for each file name 
for which file access is requested by the program. 

39. (Original) The computer program product of claim 38, wherein the association is 
stored as meta data. 

40. (Currently amended) The computer program product of claim 38, wherein the 
association includes a fil e nam e for th e fil e and a program name for the program. 
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41 . (Original) The computer program product of claim 40, wherein the association 
further includes at least one of a location of the file, a time of file access, a date of file 
access, an extension for the file, and an identification of a user of the program. 

42. (Original) The computer program product of claim 41, wherein the location of 
the file is in a remote data processing system. 

43. (Original) The computer program product of claim 38, wherein the file request is 
one of a request to open the file, close the file, copy the file, or delete the file. 

44. (Original) The computer program product of claim 38, wherein the program is a 
first program and wherein a request to open the file originates from the first program and 
a request to close the file originates fi*om a second program. 

45. (Original) The computer program product of claim 38, wherein the association 
includes the second program. 

46. (Previously presented) The computer program product of claim 38, wherein the 
first instructions, the second instructions, and the third instructions are located within an 
operating system kernel. 

47. (Previously presented) The computer program product of claim 38, wherein the 
first instructions, the second instructions, and the third instructions are located within a 
device driver. 

48. (Original) The computer program product of claim 47, wherein the drive driver 
intercepts calls directed to a mechanism used as a point of entry for the access. 

49. (Previously presented) The computer program product of claim 38, wherein the 
third instructions comprises: 
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sub-instructions for storing the association between the file and the program in a 
database. 

50. (Previously presented) The computer program product of claim 38, wherein 
associations are stored in a database and further comprising: 

fourth instructions for receiving a request from a requestor to access the 
associations; 

fifth instructions for querying the database for the associations; 
sixth instructions for receiving a result from the database; and 
seventh instructions for returning the result returned from the database to the 
requestor. 

5 1 . (Original) The computer program product of claim 50, wherein the associations 
are for a particular program. 

52. (Original) The computer program product of claim 50, wherein the associations 
are for a particular file. 

53. (Previously presented) The computer program product of claim 38, wherein the 
third instructions comprises: 

sub-instructions for storing the association between the file and the program in at 
least one of a registry, file, and a file system. 



Page 9 of 12 
Mastrianni et al. - 09/865,243 



